27. (1) The Commissioner shall not disclose to a provider information that would enable a user or a complainant to be identified if the Commissioner believes, on reasonable grounds, that the disclosure would, directly or indirectly—
(a) put at risk the health or safety of any person;
(b) occasion the receipt by a person of a health service of a lower standard than he or she would otherwise have received; or
(c) prejudice the assessment of a complaint or an investigation by the Commissioner.
(2) Where the Commissioner has failed to provide information to a provider in pursuance of subsection (1), he or she shall provide that information upon ceasing to hold the belief by virtue of the holding of which the information had not been provided.